Published: 25 Apr 2017

In part three of our series, Richard Green explains how to use Annex SL to ensure strategy decisions from the top are really being carried out on the ground. 

So far in this series we have considered the role of the management system assessor in answering the questions ‘Is management intent defined?’ and ‘Is management intent fit for purpose?’ – crucial aspects of governance.   

Once you have concluded a positive answer to these questions, you are ready to move on to assurance. Now, you can consider whether the organisation has implemented a framework capable of translating these aspirations into tangible business outcomes.

The CQI Competency Framework asks two questions relating to assurance. The first is: ‘Is management intent effectively implemented?’ The second is: ‘Does it produce the intent outcomes?’ In this article we will discuss the first question. 

Annex SL: the blueprint for the management system

As assessors, what we are looking for here is objective evidence to confirm a way of translating the policy decisions made by top management into delivered products and/or services capable of consistently meeting stakeholder requirements.

We are looking for a ‘golden thread’ which ties together policy, strategy, objectives, plans, projects, processes and individual tasks into a single coherent system – the organisation’s business management system.

Annex SL provides a blueprint which can be applied to any management system. Clause 4.4 ‘The management system’ requires compliant organisations to establish, implement, maintain and continually improve their management systems, including the processes needed for its operation and interactions.

At the same time, Clause 5.1 ‘Leadership and commitment’ requires top management to embed these processes into business as usual.

Clause 5.2 ‘Policy’ obliges top management to develop and communicate a policy statement which draws on their understanding of organisational context and commits the organisation to satisfying applicable requirements, including stakeholder requirements. The policy statement must also provide a framework for setting the management system’s objectives, which top management must ensure are compatible with overall strategic direction of the organisation.

Clause 6.2 ‘Management system objectives and planning to achieve them’ then builds the link between management system objectives and system-level planning for their achievement. Clause 8.1 ‘Operational planning and control’ links system-level planning to process design, implementation and control.

Finally, clause 9.1 ‘Monitoring, measurmement, analysis and evaluation’ requires the organisation to evaluate the performance and effectiveness of the management system overall.

If each of these elements is found to be in place, the auditor is likely to conclude that a method for implementing management intent has been established. However, if there is evidence that these elements work well together, seamlessly delivering management’s intended outcomes, the auditor is able to conclude that management intent is effectively implemented. 

The gold standard of management system audit

As audit professionals, we should feel completely at home operating in the assurance arena. Providing evidence-based, impartial assurance lies at the heart of what our profession was established to do.

If you are new to the profession, or if you feel the time is right to take your existing auditing skills to the next level, you may want to check out the range of audit-related courses offered by the CQI.

These courses provide a stepping stone to full IRCA membership, the internationally recognised gold standard of management system audit.

Next time

Now, we have established that the organisation has a management system in place with the potential to produce its intended outcomes. However, having the potential and achieving practical delivery are two different matters.

In the next part of the series, we examine the role of the assessor in verifying what is happening on the ground. Our focus shifts to monitoring, measurement, analysis and evaluation as we move away from process assurance, into product/service assurance.

Richard Green, CQP MCQI, is the CQI representative for ISO 17021-3, ISO 19011 and ISO 45001, and managing director of Kingsford Consultancy Services.